Five security questions your law firm should ask

May 12, 2017

Law firms are appealing targets for cybercriminals. Home to a multitude of sensitive, personal, confidential, financial information, what better place to attack in order to steal some juicy data? You may remember that late last year, three Chinese hackers attacked some rather large US law firms who represent Wall Street banks. They were charged with conspiracy to commit insider trading, wire fraud, and computer intrusion. So, how did the trio of cybercriminals manage to steal confidential information from these legal firms’ servers and networks? According to the Fortune article, they targeted the email accounts of partners at the law firms and then bought shares based on the data they stole. Unfortunately, these partners were the weaker link in the major law firms’ security stance, and therefore an easier target for the hackers. Alarm bells for law firms According to this Forbes article, law firms don’t have a very good track record at protecting themselves and their data. And The American Bar Association states that 25% of law firms with 100-500 employees have already been breached. This should be setting alarm bells off for legal firms. Hopefully, you’re asking: “Is there a way our legal firm can prevent a data breach?” It seems some law firms are waking up and trying to combat data breaches. Earlier this year, an American Lawyer article examined email encryption adoption amongst legal firms. The rise in cybercrimes is sparking law firms to think twice about increasing their security postures. There are certainly a few questions that should be on your security radar, let’s address them here:

What are your weakest links? Consider that your partners, vendors, and other third-parties may be much easier to hack. Cybercriminals don’t care how they get to your data, as long as they can get to it. And your smaller partners are a stepping stone to accessing the data on your network and servers. It’s important to assess your business partners and evaluate who has access to your systems – do you know?
Who are you allowing access? Preventing third-party professionals from accessing your network through insecure methods will help reduce your security risks. Your law firm can gain peace of mind from installing a software as a service platform that maintains your security, accountability and regulatory compliance. By utilizing one single tool, you’ll gain better visibility and control over your entire IT environment.
Are you tracking what people are doing? You should be trailing everyone’s movements within your network. Down to the file. Track all activity and monitor all connections to your law firm with a solution that offers you high-definition audit. Then you can gain a complete view of all actions taken – right down to the individual level. Ensuring detailed accountability for people’s actions will help eliminate your liability.
Are you sure you’re compliant? Have you got security in place that’s required to keep intellectual property safe from prying eyes? Within highly regulated industries, you’ll need to ensure your information systems are protected and that you’re compliant. Implementing secure access controls, such as identification and authentication, and enforcing rules and restrictions, will help you maintain compliance with the latest laws.
How much is a breach worth? After you’ve thought through all of the above security issues, ask yourself if it’s really worth it. The huge financial costs (not to mention reputational damage) that come from a data breach are enough to make you toss and turn at night. This Law Technology Today article says that the costs associated with a cyberattack could hit the $6 trillion mark by 2021. Thankfully, with the right tools in place, you can easily handle network access protection and secure your law firm against data breaches.